Crate gaze_mcp_core 

gaze-mcp-core

Scope

gaze-mcp enforces the chokepoint on the data-source ↔ model path. Any data flowing from a source through an MCP tool to the model passes through PiiEnvelope::dispatch and is redacted before the model sees it.

gaze-mcp does not cover the user ↔ model path. Pasted text, uploaded files, and screenshots in the agent host’s chat UI reach the model unredacted. For that axis, see gaze-proxy (planned for v0.8 — multi-vendor reverse proxy supporting Anthropic, OpenAI, Gemini).

Session ownership boundary

A single gaze::Session MUST cover exactly one authorization domain. The operator-tier export_session_tokens tool dumps the full per-Session token↔raw map. Hosts that share one Session across conversations leak the union of all conversations’ tokens through that tool. See README.md §“Session ownership boundary” for the full pattern.

---

Transport-free MCP-shaped runtime that enforces the Gaze chokepoint contract: every tool dispatch flows redact → manifest → invoke → redact → persist → return. The ordering is hard-coded inside PiiEnvelope::dispatch (the only construction site for ToolCtx) so a tool implementation cannot fabricate a context, escape the manifest, or return a response without a persisted audit trail.

Transports plug in via the Frontend trait. The companion crate gaze-mcp-rmcp ships an rmcp implementation; adopters who want a different transport implement Frontend themselves.

See docs/explanation/mcp/mcp-runtime.md and the verdict in scratchpad 1453 (brainstorm-gaze-mcp-crate-2026-05-08) for the architectural rationale.

Re-exports

pub use crate::auth::AuthError;

pub use crate::auth::AuthHook;

pub use crate::auth::DenyAllAuthHook;

pub use crate::auth::Principal;

pub use crate::ctx::SessionHandle;

pub use crate::ctx::ToolCtx;

pub use crate::ctx::ToolResources;

pub use crate::dispatch::DispatchError;

pub use crate::dispatch::PiiEnvelope;

pub use crate::frontend::DispatchHost;

pub use crate::frontend::Frontend;

pub use crate::frontend::FrontendError;

pub use crate::frontend::ShutdownToken;

pub use crate::manifest::BeginCallContext;

pub use crate::manifest::CallHandle;

pub use crate::manifest::FailureReason;

pub use crate::manifest::ManifestError;

pub use crate::manifest::ManifestStore;

pub use crate::manifest::SnapshotRef;

pub use crate::registry::ToolRegistry;

pub use crate::registry::ToolRegistryError;

pub use crate::session_id::SessionIdError;

pub use crate::session_id::SessionIdFormat;

pub use crate::session_id::SessionIdPolicy;

pub use crate::tool::ResponseRedaction;

pub use crate::tool::Tool;

pub use crate::tool::ToolDescriptor;

pub use crate::tool::ToolError;

pub use crate::tool::ToolResponse;

pub use crate::tool::ToolTier;

Modules

auth

Authorization contract for the chokepoint dispatcher.

core_tools

Re-exports of the default agent-tier tools (feature core-tools).

ctx

Sealed tool-invocation context.

dispatch

PiiEnvelope::dispatch — the chokepoint runtime.

frontend

Transport-facing traits.

manifest

Manifest persistence contract for the gaze-mcp-core chokepoint.

operator_tools

Re-exports of the operator-tier tools (feature operator-tier).

registry

Tool registry — the only legal way to put a Tool in the dispatcher’s reach.

session_id

Session-id format + entropy policy for the chokepoint dispatcher.

tool

Tool trait + descriptor + response/error types.

tools

Default tools shipped with gaze-mcp-core. Opt-in via Cargo features.